Cyble – The Growing Threat Of ChatGPT-Based Phishing Attacks

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Link – Phishing links on unofficial pages lead users to typosquatted domains masquerading as the official ChatGPT site. Quote: “The below image depicts one of the posts… a link that leads to a typosquatted domain, masquerading as the official website of ChatGPT.”
• [T1036] Masquerading – Malware uses the name and icon of ChatGPT to appear legitimate. Quote: “The malware uses the name and icon of ChatGPT but has no AI functionality.”
• [T1204.002] User Execution: Malicious File – A counterfeit OpenAI site presents a “DOWNLOAD FOR WINDOWS” button that downloads potentially harmful executables. Quote: “presents users with a ‘DOWNLOAD FOR WINDOWS’ button, which, when clicked, downloads potentially harmful executable files.”
• [T1005] Data from Local System – After execution, the stealer collects sensitive data on the victim’s device. Quote: “it can collect sensitive data without the victim’s knowledge.”
• [T1566.003] Phishing: Spearphishing via Service – Phishing pages also deliver credential and payment-collection content through fake OpenAI/ChatGPT services (credit card theft context). Quote: “phishing sites were also distributing several notorious malware families… for phishing attacks.”
• [T1489] Drive-by Compromise – Implicit in the scene where users are redirected to phishing pages that automatically prompt downloads when accessed. Quote: “links that lead users to phishing pages…”
• [T1402] Data from Information Repositories (Android): Data theft via mobile apps masquerading as ChatGPT (Spynote) – The Spynote variant steals call logs, contacts, SMSs, media, etc. Quote: “steals sensitive data such as call logs, contacts, SMSs, media files, and other data from an infected device.”